TempleWare-External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TempleWare-External.exe
Size 572KB
Sample260709-a45naaa19j
SHA256 3df696c6b16a090ce5a6187693289714f5a458026a2f9e9cd154d8de89a0e9c1
MD5 3ec25415d005655e402f93aaeef66f85
SHA1 1d19a2d4c128f330bd8aabdfea0d9eeaa16e5b43
SHA512 85d88a9b7cd79f8233740e1f17d24e71f0a24165f196d853f49584756db2e725d81ae03008256181adc198018f31cd59a74dff1bc96f41101970f80868fd7459
SSDEEP 12288:iiAn1RyG1SRgDVdYBKKdg8+aCQK8SFUc:Yn3y8dYZdg8+aCQK9U
TLSH
T14EC4BE56F2A402F9D0BED078D646E61BFA723848036496CB23E449592FE37E05B7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TempleWare-External.exe

File Explorer

TempleWare-External.exe

.exe 572KB

TempleWare-External.exe

IMPHASH 6246fbb8ef308a1699153afe7644b97b
SHA256 3df696c6b16a090ce5a6187693289714f5a458026a2f9e9cd154d8de89a0e9c1
MD5 3ec25415d005655e402f93aaeef66f85
SHA1 1d19a2d4c128f330bd8aabdfea0d9eeaa16e5b43
SHA512 85d88a9b7cd79f8233740e1f17d24e71f0a24165f196d853f49584756db2e725d81ae03008256181adc198018f31cd59a74dff1bc96f41101970f80868fd7459
SSDEEP 12288:iiAn1RyG1SRgDVdYBKKdg8+aCQK8SFUc:Yn3y8dYZdg8+aCQK9U
TLSH
T14EC4BE56F2A402F9D0BED078D646E61BFA723848036496CB23E449592FE37E05B7F712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

452348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\projects\C++\TempleWare External\x64\Release\TempleWare-External.pdb

d3d9

Direct3DCreate9

kernel32

OpenProcess CreateToolhelp32Snapshot GetLastError Process32Next CloseHandle MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WakeAllConditionVariable GetFileInformationByHandleEx Module32Next GetModuleHandleW AreFileApisANSI SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA Process32First GetModuleHandleA ReadProcessMemory WriteProcessMemory AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId Module32First InitializeSListHead LocalFree ReleaseSRWLockExclusive

user32

OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetCursorPos ReleaseCapture SetClipboardData MessageBoxA DispatchMessageA GetWindowRect DestroyWindow GetAsyncKeyState SetWindowPos LoadCursorA ScreenToClient GetCapture ShowWindow ClientToScreen IsChild TrackMouseEvent GetForegroundWindow FindWindowA SendMessageA SetCapture GetCursorPos UpdateWindow SetCursor RegisterClassExA PostQuitMessage UnregisterClassA PeekMessageA TranslateMessage GetClientRect CreateWindowExA DefWindowProcA MapVirtualKeyA GetKeyNameTextA

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Winerror_map@std@@YAHH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Strxfrm ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_counter ?_Xbad_alloc@std@@YAXXZ _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove __std_exception_copy __std_exception_destroy _CxxThrowException __std_terminate __C_specific_handler __current_exception_context __current_exception memset memcpy memchr memcmp strchr strstr

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-stdio-l1-1-0

fgets _popen fputc __stdio_common_vsscanf _wfopen fflush fseek __acrt_iob_func fclose ftell fgetc _set_fmode fwrite _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf __p__commode _pclose

api-ms-win-crt-math-l1-1-0

powf sinf atan2f logf acosf _dclass __setusermatherr asinf pow fmodf cosf sqrtf log ceilf _dsign

api-ms-win-crt-runtime-l1-1-0

_exit _invoke_watson _errno _register_thread_local_exe_atexit_callback _beginthreadex _c_exit terminate exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort

api-ms-win-crt-convert-l1-1-0

atof strtoll strtod strtoull

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-string-l1-1-0

strncpy _stricmp strcmp

api-ms-win-crt-utility-l1-1-0

qsort